code-standards 8.132.2__tar.gz → 8.132.4__tar.gz

{code_standards-8.132.2 → code_standards-8.132.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.132.2
+Version: 8.132.4
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -31,7 +31,7 @@ Requires-Dist: referencing==0.37.0
 Requires-Dist: repo-standards==6.12.9
 Requires-Dist: ruff==0.17.2
 Requires-Dist: sarj-iac-lint==0.30.1
-Requires-Dist: sarj-python-lint==1.77.2
+Requires-Dist: sarj-python-lint==1.77.3
 Requires-Dist: sarj-rule-contracts==0.4.1
 Requires-Dist: sarj-sql-lint==0.26.1
 Requires-Dist: shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')
@@ -73,7 +73,7 @@ The complete Python and JavaScript/TypeScript source gate requires named, line-l
 
 The complete Standards gate enforces Ruff's ban on `typing.cast` and `typing_extensions.cast` even when source comments, consumer Ruff configuration or manifest rule exceptions suppress `banned-api`; these cast findings cannot enter or consume the diagnostic baseline. Wildcard imports, bounded literal `getattr` names and proven read-only typing module namespace lookups through `__dict__`, `vars` and `__getattribute__` retain the same ban. Other banned APIs retain their existing exception policy. Prefer discriminated unions, explicit narrowing and typed contracts. The warning `python:no-dual-shape-model-field-reader` (SARJ522) identifies private helpers that read the same declared Pydantic fields through model `getattr` and mapping lookup branches, returning `object` or `Any`. Normalize raw input once and read typed attributes. Opaque inputs, raw validators and genuinely dynamic reflection remain supported. Review changes to missing-field handling, coercion, generated defaults and validation errors; there is no autofix.
 
-Python boolean traps are owned by Ruff FBT001, FBT002 and FBT003: positional boolean annotations, defaults and literal arguments are checked; keyword-only inputs, named arguments and the existing test exemptions remain allowed. The typed ESLint policy uses `@sarj/no-boolean-selector-parameter` at warning severity. This adapter retains maintained SonarJS S2301 detection and adds concise-arrow conditional dispatch. Prefer separate intention-revealing operations or an explicit string-literal mode. Boolean data, syntactic value mappings, stable same-operation data choices, setters and independently declared callback or inherited contracts remain allowed. Independent JSX helpers are checked; types and references establish callback contracts. It requires type information and a direct broad-boolean parameter condition. Multi-statement bodies, short-circuit guards, nullable or literal-only inputs and indirect predicates remain outside its scope. The inherited upstream block-body `onX` property exemption remains a documented blind spot. Use `code-standards check --rule eslint:no-boolean-selector-parameter` to inspect it. Noncomputed property reads count as data without proving getter effects; computed reads, including literal keys, remain outside that exemption. API changes require manual review; the rule provides no automatic rewrite.
+Python boolean traps are owned by Ruff FBT001, FBT002 and FBT003: positional boolean annotations, defaults and literal arguments are checked; keyword-only inputs, named arguments and the existing test exemptions remain allowed. The typed ESLint policy uses `@sarj/no-boolean-selector-parameter` at warning severity. Its owned detector checks single-statement operation selectors and concise-arrow conditional dispatch. Prefer separate intention-revealing operations or an explicit string-literal mode. Boolean data, syntactic value mappings, stable same-operation data choices, setters and independently declared callback or inherited contracts remain allowed. Independent JSX helpers are checked; types and references establish callback contracts. It requires type information and a direct broad-boolean parameter condition. Multi-statement bodies, short-circuit guards, nullable or literal-only inputs and indirect predicates remain outside its scope. The preserved block-body `onX` property exemption remains a documented blind spot. Use `code-standards check --rule eslint:no-boolean-selector-parameter` to inspect it. Noncomputed property reads count as data without proving getter effects; computed reads, including literal keys, remain outside that exemption. API changes require manual review; the rule provides no automatic rewrite.
 
 The shared ESLint policy also warns on unparenthesized assignments in returned expressions through native `no-return-assign`. Review whether the assignment should be a comparison or a separate state change; there is no automatic intent-changing fix. The native `except-parens` option accepts individually grouped assignments and common lazy memoization. Parentheses mark syntactic visibility, not proven intent: formatters can add or remove them without changing behavior. A chained assignment can still warn after formatting even when its outer expression is grouped. For an intentional local-variable chain, use separate assignment statements followed by return. Upstream may report several writes at the same return location. This rule does not prohibit all returned mutations or prove command/query separation. Existing typed void-return and Promise checks retain their own boundaries; an executor's returned expression alone does not prove a broken Promise.
 

{code_standards-8.132.2 → code_standards-8.132.4}/README.md

@@ -33,7 +33,7 @@ The complete Python and JavaScript/TypeScript source gate requires named, line-l
 
 The complete Standards gate enforces Ruff's ban on `typing.cast` and `typing_extensions.cast` even when source comments, consumer Ruff configuration or manifest rule exceptions suppress `banned-api`; these cast findings cannot enter or consume the diagnostic baseline. Wildcard imports, bounded literal `getattr` names and proven read-only typing module namespace lookups through `__dict__`, `vars` and `__getattribute__` retain the same ban. Other banned APIs retain their existing exception policy. Prefer discriminated unions, explicit narrowing and typed contracts. The warning `python:no-dual-shape-model-field-reader` (SARJ522) identifies private helpers that read the same declared Pydantic fields through model `getattr` and mapping lookup branches, returning `object` or `Any`. Normalize raw input once and read typed attributes. Opaque inputs, raw validators and genuinely dynamic reflection remain supported. Review changes to missing-field handling, coercion, generated defaults and validation errors; there is no autofix.
 
-Python boolean traps are owned by Ruff FBT001, FBT002 and FBT003: positional boolean annotations, defaults and literal arguments are checked; keyword-only inputs, named arguments and the existing test exemptions remain allowed. The typed ESLint policy uses `@sarj/no-boolean-selector-parameter` at warning severity. This adapter retains maintained SonarJS S2301 detection and adds concise-arrow conditional dispatch. Prefer separate intention-revealing operations or an explicit string-literal mode. Boolean data, syntactic value mappings, stable same-operation data choices, setters and independently declared callback or inherited contracts remain allowed. Independent JSX helpers are checked; types and references establish callback contracts. It requires type information and a direct broad-boolean parameter condition. Multi-statement bodies, short-circuit guards, nullable or literal-only inputs and indirect predicates remain outside its scope. The inherited upstream block-body `onX` property exemption remains a documented blind spot. Use `code-standards check --rule eslint:no-boolean-selector-parameter` to inspect it. Noncomputed property reads count as data without proving getter effects; computed reads, including literal keys, remain outside that exemption. API changes require manual review; the rule provides no automatic rewrite.
+Python boolean traps are owned by Ruff FBT001, FBT002 and FBT003: positional boolean annotations, defaults and literal arguments are checked; keyword-only inputs, named arguments and the existing test exemptions remain allowed. The typed ESLint policy uses `@sarj/no-boolean-selector-parameter` at warning severity. Its owned detector checks single-statement operation selectors and concise-arrow conditional dispatch. Prefer separate intention-revealing operations or an explicit string-literal mode. Boolean data, syntactic value mappings, stable same-operation data choices, setters and independently declared callback or inherited contracts remain allowed. Independent JSX helpers are checked; types and references establish callback contracts. It requires type information and a direct broad-boolean parameter condition. Multi-statement bodies, short-circuit guards, nullable or literal-only inputs and indirect predicates remain outside its scope. The preserved block-body `onX` property exemption remains a documented blind spot. Use `code-standards check --rule eslint:no-boolean-selector-parameter` to inspect it. Noncomputed property reads count as data without proving getter effects; computed reads, including literal keys, remain outside that exemption. API changes require manual review; the rule provides no automatic rewrite.
 
 The shared ESLint policy also warns on unparenthesized assignments in returned expressions through native `no-return-assign`. Review whether the assignment should be a comparison or a separate state change; there is no automatic intent-changing fix. The native `except-parens` option accepts individually grouped assignments and common lazy memoization. Parentheses mark syntactic visibility, not proven intent: formatters can add or remove them without changing behavior. A chained assignment can still warn after formatting even when its outer expression is grouped. For an intentional local-variable chain, use separate assignment statements followed by return. Upstream may report several writes at the same return location. This rule does not prohibit all returned mutations or prove command/query separation. Existing typed void-return and Promise checks retain their own boundaries; an executor's returned expression alone does not prove a broken Promise.
 

{code_standards-8.132.2 → code_standards-8.132.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.132.2"
+version = "8.132.4"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -32,7 +32,7 @@ dependencies = [
   "ruff==0.17.2",
   "shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')",
   "sarj-iac-lint==0.30.1",
-  "sarj-python-lint==1.77.2",
+  "sarj-python-lint==1.77.3",
   "sarj-sql-lint==0.26.1",
   "typer==0.27.3",
 ]

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/api.py

@@ -228,7 +228,10 @@ class Standards:
                     exit_code=_INVALID_EXIT,
                 )
             try:
-                policy_findings = check_selected_library_policy(self.root, selected)
+                selected_groups = group_paths(selected, policy=policy)
+                policy_findings = check_selected_library_policy(
+                    self.root, selected, python_paths=selected_groups.python
+                )
             except (OSError, TypeError, ValueError, ManifestPolicyError) as exc:
                 return Result(
                     Status.INVALID,
@@ -239,7 +242,7 @@ class Standards:
                 Finding(item.id, "error", item.message, str(item.path), f"use {item.replacement}")
                 for item in policy_findings
             )
-            source_status = check(selected, policy=policy)
+            source_status = check(selected, policy=policy, grouped=selected_groups)
             eslint_status = execute(selected_eslint_commands(self.root, selected))
             return _operation_result(max(source_status, eslint_status, 1 if findings else 0), findings=findings)
         return _operation_result(_verify(self.root))
@@ -306,7 +309,9 @@ class Standards:
                 rule_selection=rule_selection,
             )
             if rule_selection is None:
-                native = _with_library_policy(self.root, native, active_selected, selection_policy)
+                native = _with_library_policy(
+                    self.root, native, active_selected, selection_policy, python_paths=selected_groups.python
+                )
             if rule_selection is None and normalized_mode is AnalysisMode.POLICY:
                 native = _with_repository_analysis(self.root, native, staged=staged)
             prepared = _prepared_reports(self.root, adopted, prepared_devops, prepared_targets, trust=normalized_trust)
@@ -513,12 +518,11 @@ def _verify(root: Path) -> int:
         return _INVALID_EXIT
     verify_paths = adopted.verify_paths if adopted is not None else (".",)
     policy = Policy.from_manifest(root, adopted)
-    if check(
-        [str(root / path) for path in verify_paths],
-        policy=policy,
-    ):
+    selected = [str(root / path) for path in verify_paths]
+    selected_groups = group_paths(selected, policy=policy)
+    if check(selected, policy=policy, grouped=selected_groups):
         return 1
-    if check_library_policy(root):
+    if check_library_policy(root, python_paths=selected_groups.python):
         return 1
     return execute(verification_commands(detect(root)))
 
@@ -881,10 +885,15 @@ def _selected_external_analysis(
 
 
 def _with_library_policy(
-    root: Path, native: AnalysisReport, active_selected: list[str], selection_policy: Policy
+    root: Path,
+    native: AnalysisReport,
+    active_selected: list[str],
+    selection_policy: Policy,
+    *,
+    python_paths: Sequence[str] = (),
 ) -> AnalysisReport:
     try:
-        policy = _filter_tool_report(_policy_report(root, active_selected), selection_policy)
+        policy = _filter_tool_report(_policy_report(root, active_selected, python_paths=python_paths), selection_policy)
     except (OSError, TypeError, ValueError, ManifestPolicyError) as exc:
         issue = ExecutionIssue("sarj-library-policy", "policy-failure", f"{type(exc).__name__}: {exc}")
         policy = ToolReport("sarj-library-policy", Completion.FAILED, issues=(issue,))
@@ -1137,8 +1146,8 @@ def _engine_for_diagnostic(item: Diagnostic) -> RuleEngine | None:
     }.get(item.source)
 
 
-def _policy_report(root: Path, selected: Sequence[str]) -> ToolReport:
-    findings = check_selected_library_policy(root, selected)
+def _policy_report(root: Path, selected: Sequence[str], *, python_paths: Sequence[str] = ()) -> ToolReport:
+    findings = check_selected_library_policy(root, selected, python_paths=python_paths)
     documents: dict[Path, SourceDocument] = {}
     diagnostics: list[Diagnostic] = []
     for finding in findings:

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/configs/cli-reference.v1.json

@@ -3316,6 +3316,6 @@
   },
   "program": "code-standards",
   "schemaVersion": 1,
-  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.132.2).",
-  "version": "8.132.2"
+  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.132.4).",
+  "version": "8.132.4"
 }

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/configs/eslint.peers.json

@@ -19,7 +19,7 @@
     "@eslint-community/eslint-plugin-eslint-comments": "4.8.1",
     "@eslint/compat": "2.1.1",
     "@eslint/js": "10.0.1",
-    "@sarj/eslint-plugin": "16.30.2",
+    "@sarj/eslint-plugin": "16.30.4",
     "@shadcn/lint": "0.2.3",
     "@typescript/native": "npm:typescript@7.0.2",
     "@vitest/eslint-plugin": "1.6.28",
@@ -35,7 +35,6 @@
     "eslint-plugin-react": "7.37.5",
     "eslint-plugin-react-hooks": "7.1.1",
     "eslint-plugin-simple-import-sort": "14.0.0",
-    "eslint-plugin-sonarjs": "4.2.2",
     "eslint-plugin-testing-library": "7.16.2",
     "eslint-plugin-unicorn": "79.0.0",
     "eslint-plugin-zod": "5.2.2",
@@ -46,7 +45,7 @@
     "eslint-plugin-regexp": "3.3.1"
   },
   "ageGatePreapprovals": {
-    "@sarj/eslint-plugin": "16.30.2"
+    "@sarj/eslint-plugin": "16.30.4"
   },
   "yarnIdentityPins": {
     "@typescript-eslint/eslint-plugin": "8.72.0",

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/configs/eslint.strict.mjs

@@ -14,7 +14,6 @@ import node from "eslint-plugin-n";
 import perfectionist from "eslint-plugin-perfectionist";
 import promiseModule from "eslint-plugin-promise";
 import simpleImportSort from "eslint-plugin-simple-import-sort";
-import sonarjs from "eslint-plugin-sonarjs";
 import betterTailwindcss from "eslint-plugin-better-tailwindcss";
 import { plugin as shadcn, project as shadcnProject } from "@shadcn/lint";
 import jsdoc from "eslint-plugin-jsdoc";
@@ -693,7 +692,6 @@ export function createConfig(options = {}) {
                 perfectionist,
                 promise,
                 "simple-import-sort": simpleImportSort,
-                sonarjs,
                 jsdoc,
                 shadcn: scopedShadcn,
                 "@sarj": sarj,

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/configs/eslint.strict.ts

@@ -16,7 +16,6 @@ import perfectionist from "eslint-plugin-perfectionist";
 // @ts-expect-error -- The pinned promise plugin exports CommonJS without TypeScript declarations.
 import promiseModule from "eslint-plugin-promise";
 import simpleImportSort from "eslint-plugin-simple-import-sort";
-import sonarjs from "eslint-plugin-sonarjs";
 import betterTailwindcss from "eslint-plugin-better-tailwindcss";
 import { plugin as shadcn, project as shadcnProject } from "@shadcn/lint";
 import jsdoc from "eslint-plugin-jsdoc";
@@ -795,7 +794,6 @@ export function createConfig(options: ConfigOptions = {}): Linter.Config[] {
       perfectionist,
       promise,
       "simple-import-sort": simpleImportSort,
-      sonarjs,
       jsdoc,
       shadcn: scopedShadcn,
       "@sarj": sarj,

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/configs/ruff.strict.toml

@@ -289,7 +289,6 @@ warns-extend-require-match-for = [
 "futures".msg = "LIB017: Remove the obsolete futures backport on Python 3.14. Replace with concurrent.futures."
 "importlib_metadata".msg = "LIB013: Python 3.14 provides importlib.metadata. Replace with importlib.metadata."
 "importlib_resources".msg = "LIB014: Python 3.14 provides importlib.resources. Replace with importlib.resources."
-"logging".msg = "LIB023: Standards standardizes application logging on loguru, whose bound context carries correlation fields to every line; a second stdlib logger splits the logs. A loguru bridge that intercepts third-party stdlib records needs a local, reasoned TID251 suppression. Replace with loguru."
 "marshmallow".msg = "LIB007: Standards standardizes validation and serialization on Pydantic. Replace with Pydantic."
 "mock".msg = "LIB022: Python 3.14 provides unittest.mock. Replace with unittest.mock."
 "nose".msg = "LIB021: Nose is unmaintained; use pytest. Replace with pytest."

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/libs/linting/library_policy.py

@@ -4,6 +4,7 @@ from dataclasses import dataclass
 import json
 from pathlib import Path
 import re
+import tokenize
 import tomllib
 from typing import TYPE_CHECKING, Final, Literal, NamedTuple
 
@@ -11,6 +12,7 @@ from packaging.requirements import InvalidRequirement, Requirement
 from packaging.utils import canonicalize_name
 
 from sarj_standards.libs.adoption.manifest import as_table, list_field
+from sarj_standards.libs.filesystem import is_link_like
 from sarj_standards.libs.json_boundary import parse_json
 from sarj_standards.libs.typed_containers import is_object_mapping
 
@@ -225,9 +227,9 @@ CATALOG: Final[tuple[LibraryMapping, ...]] = (
         "preferred-stack",
         "logging",
         "loguru",
-        "Standards standardizes application logging on loguru, whose bound context carries correlation fields to "
-        "every line; a second stdlib logger splits the logs. A loguru bridge that intercepts third-party stdlib "
-        "records needs a local, reasoned TID251 suppression.",
+        "Use Loguru for application-owned log events and standalone output sinks so bound correlation context "
+        "stays intact. Standard-library SDK adapters, types, levels and record routing remain supported; "
+        "the application preference excludes native test paths without disabling logging correctness checks.",
     ),
     _mapping(
         "LIB101",
@@ -378,7 +380,7 @@ def python_banned_api() -> dict[str, str]:
     return {
         name: f"{entry.id}: {entry.message} Replace with {entry.replacement}."
         for entry in CATALOG
-        if entry.ecosystem == "python"
+        if entry.ecosystem == "python" and entry.id != "LIB023"
         for name in entry.imports
     }
 
@@ -416,6 +418,9 @@ class ManifestPolicyError(ValueError):
     """An applicable dependency manifest cannot be parsed safely."""
 
 
+_MAX_PYTHON_POLICY_SOURCE_BYTES: Final = 500_000
+
+
 _IGNORED_DIRS: Final = frozenset(
     {
         ".cache",
@@ -448,9 +453,18 @@ _GENERATED_MARKERS: Final = (
 _REQUIREMENTS_NAME: Final = re.compile(r"^requirements(?:[-_.].*)?\.(?:txt|in)$", re.IGNORECASE)
 
 
-def scan(root: Path, *, allowed_ids: Iterable[str] = ()) -> tuple[Finding, ...]:
+def scan(
+    root: Path,
+    *,
+    allowed_ids: Iterable[str] = (),
+    python_paths: Iterable[str | Path] = (),
+) -> tuple[Finding, ...]:
     root = root.resolve()
-    return _scan_manifests(root, _manifest_paths(root), allowed_ids=allowed_ids)
+    allowed = frozenset(allowed_ids)
+    return _combined_findings(
+        _scan_manifests(root, _manifest_paths(root), allowed_ids=allowed),
+        _scan_python_sources(root, python_paths, allowed_ids=allowed),
+    )
 
 
 def scan_paths(
@@ -458,8 +472,10 @@ def scan_paths(
     paths: Iterable[str | Path],
     *,
     allowed_ids: Iterable[str] = (),
+    python_paths: Iterable[str | Path] = (),
 ) -> tuple[Finding, ...]:
     root = root.resolve()
+    allowed = frozenset(allowed_ids)
     selected: set[Path] = set()
     for raw_path in paths:
         candidate = Path(raw_path)
@@ -472,7 +488,79 @@ def scan_paths(
             selected.update(_manifest_paths(resolved))
         elif resolved.is_file() and accepts_path(resolved, root):
             selected.add(resolved)
-    return _scan_manifests(root, tuple(sorted(selected)), allowed_ids=allowed_ids)
+    return _combined_findings(
+        _scan_manifests(root, tuple(sorted(selected)), allowed_ids=allowed),
+        _scan_python_sources(root, python_paths, allowed_ids=allowed),
+    )
+
+
+def _combined_findings(*groups: tuple[Finding, ...]) -> tuple[Finding, ...]:
+    return tuple(
+        sorted(
+            {item for group in groups for item in group},
+            key=lambda item: (str(item.path), item.line, item.id, item.package, item.column),
+        )
+    )
+
+
+def _scan_python_sources(
+    root: Path, paths: Iterable[str | Path], *, allowed_ids: frozenset[str]
+) -> tuple[Finding, ...]:
+    paths = tuple(paths)
+    if not paths or "LIB023" in allowed_ids:
+        return ()
+    from sarj_python_lint import application_logging_uses  # ruff: ignore[import-outside-top-level] -- load the public Python preference API only for selected Python source.
+
+    entry = next(entry for entry in CATALOG if entry.id == "LIB023")
+    findings: list[Finding] = []
+    selected = {_selected_python_source_path(root, raw_path) for raw_path in paths}
+    for path in sorted(selected):
+        try:
+            with tokenize.open(path) as stream:
+                source = stream.read()
+        except (SyntaxError, UnicodeError) as exc:
+            msg = f"cannot decode selected Python policy source: {path}"
+            raise ManifestPolicyError(msg) from exc
+        findings.extend(
+            Finding(
+                entry.id,
+                path.relative_to(root),
+                use.line,
+                use.column,
+                "logging",
+                entry.replacement,
+                f"{entry.message} Observed {use.operation}.",
+            )
+            for use in application_logging_uses(path, source, root=root)
+        )
+    return tuple(findings)
+
+
+def _selected_python_source_path(root: Path, raw_path: str | Path) -> Path:
+    candidate = Path(raw_path)
+    candidate = candidate if candidate.is_absolute() else root / candidate
+    if ".." in candidate.parts:
+        msg = f"selected Python policy source escapes repository root: {raw_path}"
+        raise ManifestPolicyError(msg)
+    try:
+        relative = candidate.relative_to(root)
+    except ValueError as exc:
+        msg = f"selected Python policy source escapes repository root: {raw_path}"
+        raise ManifestPolicyError(msg) from exc
+    cursor = root
+    for part in relative.parts:
+        if is_link_like(cursor := cursor / part):
+            msg = f"selected Python policy source traverses a symlink: {raw_path}"
+            raise ManifestPolicyError(msg)
+    path = candidate.resolve(strict=True)
+    if (
+        not path.is_file()
+        or path.suffix not in {".py", ".pyi"}
+        or path.stat().st_size > _MAX_PYTHON_POLICY_SOURCE_BYTES
+    ):
+        msg = f"expected a bounded canonical Python source, not a directory: {raw_path}"
+        raise ManifestPolicyError(msg)
+    return path
 
 
 def _scan_manifests(

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/libs/linting/runner.py

@@ -177,8 +177,9 @@ def run(
     noise_only: bool = False,
     python_baseline: str | None = None,
     policy: Policy | None = None,
+    grouped: GroupedPaths | None = None,
 ) -> int:
-    grouped = group_paths(files, policy=policy)
+    grouped = group_paths(files, policy=policy) if grouped is None else grouped
     statuses = [
         _run_tool(
             "sarj_python_lint",

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/libs/repository/docs.py

@@ -343,15 +343,15 @@ def _package_usage(name: str, engine: str | None) -> str:
             "Python boolean traps are owned by Ruff FBT001, FBT002 and FBT003: positional boolean "
             "annotations, defaults and literal arguments are checked; keyword-only inputs, named "
             "arguments and the existing test exemptions remain allowed. The typed ESLint policy "
-            "uses `@sarj/no-boolean-selector-parameter` at warning severity. This adapter retains "
-            "maintained SonarJS S2301 detection and adds concise-arrow conditional dispatch. "
+            "uses `@sarj/no-boolean-selector-parameter` at warning severity. Its owned detector checks "
+            "single-statement operation selectors and concise-arrow conditional dispatch. "
             "Prefer separate intention-revealing operations or an explicit string-literal mode. "
             "Boolean data, syntactic value mappings, stable same-operation data choices, "
             "setters and independently declared callback or inherited contracts remain allowed. "
             "Independent JSX helpers are checked; types and references establish callback contracts. "
             "It requires type information and a direct broad-boolean parameter condition. "
             "Multi-statement bodies, short-circuit guards, nullable or literal-only inputs and "
-            "indirect predicates remain outside its scope. The inherited upstream block-body "
+            "indirect predicates remain outside its scope. The preserved block-body "
             "`onX` property exemption remains a documented blind spot. Use "
             "`code-standards check --rule eslint:no-boolean-selector-parameter` to inspect it. "
             "Noncomputed property reads count as data without proving getter effects; computed "

{code_standards-8.132.2 → code_standards-8.132.4}/src/sarj_standards/libs/repository/hooks.py

@@ -20,7 +20,7 @@ from sarj_standards.libs.json_boundary import parse_json
 from sarj_standards.libs.typed_containers import is_object_mapping
 
 
-_VERSION: Final = "2.2.1"
+_VERSION: Final = "2.2.2"
 _CORE_HOOKS: Final = ("pre-commit", "pre-push", "commit-msg")
 _LFS_POST_HOOKS: Final = ("post-checkout", "post-commit", "post-merge")
 _DISCOVERY_TIMEOUT: Final = timedelta(seconds=5)